Veracode Vulnerability DatabaseVERACODE:46206Local File Inclusion
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
6.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.5%
voila is vulnerable to Local File Inclusion. The vulnerability is due to improper handling of file paths within app.py which allows an attacker to access readable files on the server’s filesystem.
References
github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2
github.com/advisories/GHSA-2q59-h24c-w6fg
github.com/voila-dashboards/voila/commit/00d6362c237b6b4d466873535554d6076ead0c52
github.com/voila-dashboards/voila/commit/28faacc9b03b160fd8fa920ad045f4ec0667ab67
github.com/voila-dashboards/voila/commit/5542e4ae36bb5d184deaa48f95e76be477756af2
github.com/voila-dashboards/voila/commit/98b6a40fec27723572314fdbba99bdc147d904c8
github.com/voila-dashboards/voila/commit/c045be6988539d07cceeb9f82fc660a49485d504
github.com/voila-dashboards/voila/security/advisories/GHSA-2q59-h24c-w6fg
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
6.7 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
10.5%